From the course: CompTIA Security+ (SY0-701) Cert Prep: 1 General Security Concepts

Key escrow

From the course: CompTIA Security+ (SY0-701) Cert Prep: 1 General Security Concepts

Start my 1-month free trial

Key escrow

“

Strong encryption is very difficult to defeat, and this causes a problem for law enforcement and other government agencies who feel that they have a right to access encrypted communications. That's where the concept of key escrow comes into play. Just like a financial escrow account at a bank, the concept of escrow here means that someone is holding something for use by someone else if certain conditions are met. In this case, government officials have proposed key escrow technologies that would provide law enforcement with access to encrypted information. The idea is that government agents would have to obtain a court order before accessing escrowed keys, protecting the privacy of other individuals. While this may be a reasonable goal, there is not yet a reasonable way to implement this approach in a secure manner. Perhaps the most concerted effort to deploy key escrow technology occurred way back in 1993, when the government proposed a technology known as the Clipper chip, shown here. The chip performed encryption, but it included a special law enforcement access field or leaf value, that allowed government agents to access the content of the communication. The Clipper chip caused a tremendous public controversy, as groups like the Electronic Frontier Foundation joined forces with security firms like RSA to campaign publicly against the Clipper chip's government backdoor. These lobbying efforts worked, and the Clipper chip never became widely adopted. After further analysis of the Clipper chip's algorithm, security researchers discovered that it contained fundamental flaws that would have prevented its secure use in the first place. Government agencies are still trying to find ways to gain access to the keys used to protect strongly encrypted communications. In 2016, the FBI demanded that Apple assist them in gaining access to an encrypted iPhone that the government was using as evidence in a criminal investigation. Apple objected to this request on the grounds that weakening the security of the iPhone encryption software would jeopardize the security of millions of iPhone users. We're left in a difficult situation with two competing interests. The government has a legitimate need to access information when they have a legitimately issued warrant. But on the other hand, consumers expect technology companies to build secure products that keep out all kinds of unwanted intruders. In a related scenario, organizations sometimes have the need to recover the encryption key of a user. This may be simply because the user has forgotten their password, or perhaps the user left the organization and business leaders need to access information encrypted with that user's key. Some encryption products, such as the Microsoft Windows Encrypting File System, provide for the use of a recovery agent in these scenarios. The recovery agent possesses a master key that may decrypt any information in the organization. That key must be protected carefully as it allows global access to all encrypted data in the organization.

Contents